No pre-commit security scan

Does the project run a security hook at pre-commit time?

A local git-hook security scan — secret scanning, SAST, or IaC scanning — runs on the developer’s machine before a commit is created, catching problems at the earliest and cheapest point in the lifecycle (SPVS V2.4.16). The check recognises the common local-hook frameworks — pre-commit (.pre-commit-config.yaml), Husky (.husky/ hook scripts), Lefthook (lefthook.yml) and Overcommit (.overcommit.yml) — and checks whether any of them references a known security tool.

To avoid false positives, the finding is reported only when a hook framework is actually configured but runs no security hook (e.g. only formatters/linters). A repository that uses no local-hook framework is not reported: such teams typically enforce the equivalent checks in CI (secrets_scan, sast_in_use), so flagging the mere absence of one specific tool would be noise.

Recognised security hooks (configurable) include secret scanners (gitleaks, detect-secrets, trufflehog, detect-private-key, ggshield/GitGuardian, talisman) and SAST/IaC scanners (bandit, semgrep, checkov, tfsec, trivy).

Shifting a security scan left to pre-commit stops the most common leaks (a committed .env, a private key, an obvious injection) before they ever enter history, where they are expensive to purge and may already have been cloned. It complements server-side scanning; it does not replace it.

Add pre-commit to the project and configure at least one security hook in .pre-commit-config.yaml, for example a secret scanner (gitleaks, detect-secrets) and/or a SAST/IaC scanner (semgrep, checkov). Commit the config so every contributor gets the hook.

To change these options you can modify SCANNER_DIR/conf/misconfigurations/pre_commit_security_scan.yml. The following are the default configuration properties: